CTO @TrustedSec | Former Optiv/SecureWorks/Accuvant Labs/Redspin | Race cars
/tmp/.a
Joined April 2008
- Tweets67.6K
- Following5K
- Followers75.2K
- Likes145K
Justin Elze retweeted
Honestly, yesterday's PHP vuln chaos wasn't that different from what we've seen in the past. The classic "it's coming get ready" race to reproduce coupled with the classic misleading noise from the discussion feels pretty familiar. Humans make it messy.
Justin Elze retweeted
The actual prompt for this was "let's look for pre-auth RCEs in PHP". I'm sharing this so people know this stuff is real and to take agent-assisted scanning seriously.
I kicked if off using Claude Mythos 5.1 (in stock Claude Code) but it uses a skill to drive a harness we built over the last few months.
I don't know if the harness is amazing, but it certainly has a scary track record so far. It's setup to do an agent guided tree search across a codebase, and runs in microvm sandboxes that all have the full source code for the target, as well as the source for any transitive dependencies.
When I built the harness I basically just fed Claude a bunch of Project Zero blog posts describing how they did research and had it build a harness that ran like that, but on our tech stack.
The first phase is just setup and can run with any model, it just does that fetching and assembles the kit environment, and gets a target up and running alongside the source code.
Then we just do some basic suspend/resume stuff over to the hunt phase, where one agent supervises the tree, and the first node kicks off.
Each node is context-aware and aware of the work of all the others. I think I ran this with parallelism 4? So 4 running at any one time. The supervisor can shape the tree and boost nodes or prune. Any node can add more below it with targeted instructions.
A typical run looks like the first node doing a codebase review or building and running a fuzzer or something, all depending on the target. Then based on whatever it finds, it'll queue 4-5 children that go look into those areas. The main system guidance is to validate everything 3 times in clean VMs, and we typically require full exploit chains/POCs.
Here's what this run looked like.
We're doing this with a bunch of other open source projects now and companies. We're doing a lot of this for free, even with private companies, across critical infrastructure. We're directly partnered with Anthropic, and can do this even if you don't have direct access to a frontier model yourself.
Justin Elze retweeted
Yep. Because you can't just prompt "find me all the vulnerabilties". Maybe in awhile but we're nowhere near that now.
Skilled researchers, custom harnesses, and other techniques are changing the bug depth game, in addition to bringing down the cost.
wait, PHP was actually scanned by Anthropic’s Claude Mythos earlier this year. they also had access to OpenAI’s Daybreak Red for validating exploits.
the PHP Foundation revealed this JUST yesterday.
keeping frontier cyber models in the hands of a selected few doesn’t seem to be working well for the internet.
thephp.foundation/blog/2026/…
Justin Elze retweeted
Anthropic should provide a setting where you can ask the safety filters to knock you down to Opus 4.6 or 4.7 instead of Worst Opus Ever
Justin Elze retweeted
Adding this to the lab, github.com/dinosn/php-cve-20… , this will work on stock, official php:8.4.26-apache image, no php.ini change, single-worker
prefork, display_errors=Off . Default has the 128M allocation, not the 8M that is on labs. All work in progress. I don't see realistic scenario though without spamming heavily and for long time servers.
Justin Elze retweeted
Just published our high fidelity scanner for php2shell: github.com/assetnote/php2she…
See our detection logic here: slcyber.io/research/high-fid…
We've taken care in our detection logic and hope it helps defenders. Congrats to @calif_io and @lcfr_hax for the discovery.
Justin Elze retweeted
A great reminder that Entra App Proxy, Cloudflare Tunnels/Access, or some sort of ZTNA is a great way to remove stuff you don't want hacked from the Internet
Justin Elze retweeted
Added support for the compromised eMudhra intermediaries to gopostille. It'll let you create a validly signed certificate chain for a clone leaf cert in places that haven't revoked them. 1/2
Justin Elze retweeted
Autonomous LLM work on the PHP bugs was a real worry until you realise how few people understand exploitation well enough to prompt around ASLR and offsets. So many lab only /goal outcomes masquerading as something more general.
Justin Elze retweeted
When looking for exploitation of emerging vulnerabilities I regularly see defenders looking for IOCs lists, specific artifacts of open-source POC code etc. to build your detections on. While these are valuable, they are only a small part of the story and they won't catch everything.
Historically the life cycle went: CVE/0-day released -> POC released -> hunt for signs of exploitation -> variant hunting. In the first few days of disclosure, the same POC code was weaponized by many actors, which meant those first days of detection were some what simple.
However, in the world of AI, the barrier to entry for writing exploit code has been dramatically lowered and you can't be sure that the POC code shared on GitHub is the one being used to target your environment. In fact, exploits may be weaponized simply by analyzing update and patch content.
Without concrete indicators, often the best way to detect something novel in your environment is to use your existing telemetry as your base line and then pattern our what is new. Your SIEM is an archive of what is normal in your environment - broken down to what is normal for every single asset.
When something new and emerging drops, find high risk deviations from that, on your vulnerable and exposed assets.
Has this file ever spawned a process in this way? Has this process ever crashed like this? Are files regularly created in this directory? Does this process usually create files? Baseline left of the disclosure, detect deviations right of the disclosure = find bad.
Justin Elze retweeted
#php2shell. seems to be hard to exploit (mem corruption vs aslr). yes, public pocs now are lab-only rces. this is a good one: github.com/9bie/php2shell-by…
limited to an unrealistic one-worker php-fpm. but it can be upgraded to N workers if we manage to hold N-1 workers :) here it is.
Justin Elze retweeted
The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application. msft.it/6018aakEE
Our investigation found that Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in. AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access.
Read our blog for a detailed analysis and indicators of compromise (IOCs), along with Microsoft Defender detections, protection recommendations, and guidance on investigating service principal sign-ins and unexpected application credential or privilege changes.
Justin Elze retweeted
PHP exploitation attempts hit AWS honeypots four days before disclosure, and all we get for IOCs is six IPs like it’s 2003.
can someone put some honeypots behind finch (github.com/0x4D31/finch) or something so we get actual telemetry, at least until the @GreyNoiseIO folks get back to work?
PHP2Shell (CVE-2026-109618/109619) hit our MadPot honeypots on Oct 17, four days before disclosure.
Investigating? Start your timeline there, not at the advisory date. Patch to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 now.
aws.amazon.com/blogs/securit…
Justin Elze retweeted
For the next few months, we are looking at frequent discoveries of long-standing bugs - competent code auditing has gotten cheap and abundant. This carries a few consequences:
Justin Elze retweeted
People are getting free goop and they're "warning" people?
This generation makes me SICK.
I speak for everyone when I say we need the goop NOW!!!!!
Justin Elze retweeted
fear not!
this is no cyberpocalypse
this is the internet’s immune system finally waking up to an illness it has always had
a mere fever
the 0days were always there
the only thing that changed is awareness
now we begin the healing process ⚕️
